From 8a1ad78e258b73a82ae35bc9ba28b0a30c80fc2e Mon Sep 17 00:00:00 2001 From: Sho Uemura Date: Fri, 3 Apr 2026 18:11:03 -0500 Subject: [PATCH 1/3] update actions versions, split wheels action into two jobs as recommended --- .github/workflows/test_zcu111.yml | 4 +-- .github/workflows/update_version.yml | 2 +- .github/workflows/wheels.yml | 38 ++++++++++++++++++++-------- 3 files changed, 30 insertions(+), 14 deletions(-) diff --git a/.github/workflows/test_zcu111.yml b/.github/workflows/test_zcu111.yml index 48c14b387..09a830fe2 100644 --- a/.github/workflows/test_zcu111.yml +++ b/.github/workflows/test_zcu111.yml @@ -26,7 +26,7 @@ jobs: run: | sudo git clean -ffdx sudo git reset --hard HEAD - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Install package run: | sudo -E -H python -m pip install -e . @@ -42,7 +42,7 @@ jobs: sudo -E python -m pytest --nbmake ./qick_demos/07_Sweep_ND_variables.ipynb sudo -E python -m pytest --nbmake ./qick_demos/08_Special_buffers.ipynb - name: Archive test results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v6 with: name: demo_notebooks path: qick_demos/*.ipynb diff --git a/.github/workflows/update_version.yml b/.github/workflows/update_version.yml index b9810d764..900a75e06 100644 --- a/.github/workflows/update_version.yml +++ b/.github/workflows/update_version.yml @@ -47,7 +47,7 @@ jobs: VERSION_PATH: qick_lib/qick/VERSION CHECK_TOKEN: ${{ secrets.CHECK_TOKEN }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Checkout pull request run: gh pr checkout $PR_NUMBER - name: Compare version numbers diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml index 48a891580..ddff1a922 100644 --- a/.github/workflows/wheels.yml +++ b/.github/workflows/wheels.yml @@ -18,26 +18,42 @@ on: permissions: contents: read pull-requests: read - id-token: write jobs: - build_and_publish: + build: if: github.event.pull_request.merged == true runs-on: ubuntu-latest - environment: release - permissions: - # IMPORTANT: this permission is mandatory for trusted publishing - id-token: write - steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Set up Python - uses: actions/setup-python@v4 + uses: actions/setup-python@v6 with: python-version: "3.x" - name: Build wheel run: | python -m pip install --user --upgrade pip build wheel python -m build - - name: Publish distribution to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + - name: Store the distribution packages + uses: actions/upload-artifact@v6 + with: + name: python-package-distributions + path: dist/ + + publish-to-pypi: + needs: + - build + runs-on: ubuntu-latest + environment: + name: release + url: https://pypi.org/p/qick + permissions: + # IMPORTANT: this permission is mandatory for trusted publishing + id-token: write + steps: + - name: Download all the dists + uses: actions/download-artifact@v6 + with: + name: python-package-distributions + path: dist/ + - name: Publish distribution to PyPI + uses: pypa/gh-action-pypi-publish@release/v1 From 27177e78625443094371cb163481ed6a8ab9ef3f Mon Sep 17 00:00:00 2001 From: Sho Uemura Date: Fri, 3 Apr 2026 18:23:45 -0500 Subject: [PATCH 2/3] change workflow trigger --- .github/workflows/wheels.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml index ddff1a922..8456dab53 100644 --- a/.github/workflows/wheels.yml +++ b/.github/workflows/wheels.yml @@ -1,6 +1,11 @@ # Build a wheel and publish to PyPI when a pull request merges. # https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ # +# Based on https://github.com/orgs/community/discussions/26724#discussioncomment-3253102 we trigger this workflow on a push to main branch, and protect the main branch. +# +# We previously used the pull_request_target workflow trigger, but it seems that since sometime between January and March 2026 this no longer works with trusted publishing. +# How that used to work: +# # We need access to the repo secrets, which are only available using the pull_request_target trigger. # For security this requires us to use the repo HEAD and not the PR merge commit. # But since this action only executes on merge, those are the same thing. @@ -9,9 +14,7 @@ name: Build wheel on: - pull_request_target: - types: - - closed + push: branches: - main @@ -21,7 +24,6 @@ permissions: jobs: build: - if: github.event.pull_request.merged == true runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 From 704d9eee0a9696895ff75c3f3e1feb839efcf3b2 Mon Sep 17 00:00:00 2001 From: "QICK actions [bot]" <129547417+qickbot@users.noreply.github.com> Date: Fri, 3 Apr 2026 23:39:10 +0000 Subject: [PATCH 3/3] update version --- qick_lib/qick/VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qick_lib/qick/VERSION b/qick_lib/qick/VERSION index 5edd2f0ee..3945146a7 100644 --- a/qick_lib/qick/VERSION +++ b/qick_lib/qick/VERSION @@ -1 +1 @@ -0.2.397 +0.2.398